search

code-423n4 / 2021-06-gro-findings

0 stars 1 forks source link

Rational actors will just set themselves as referral #108

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

cmichel

Vulnerability details

Vulnerability Details

When depositing, a referral can be chosen and the only check is:

account != address(0) && referral != address(0) && referrals[account] == address(0)

One can refer themselves

Impact

(From the contracts that are part of this repo, it's not immediately clear what the referrals are used for.) If they are used for anything, rational actors will always refer themselves to maximize profits making the referral system useless.

Recommended Mitigation Steps

Whitelist big influencers that are allowed to be used as referrals to avoid everyone referring themselves or another account they control.

kitty-the-kat commented 2 years ago

not an issue/non-critical Makes no difference, referrals are calculated offchain and not used for anything on chain

ghoul-sol commented 2 years ago

Even if this is calculated off-chain, technically being able to refer ourselves is an issue. Even offchain this needs to be filtered out which is extra work. I'm keeping this as low risk.